Skip to content

M68K: INT32_MIN displacement triggers signed overflow in printer #3040

Description

@carrerasdarren-cell

Work environment

Questions Answers
System Capstone runs on OS/arch/bits macOS arm64 and Linux arm64, 64-bit
Capstone module affected M68K
Source of Capstone git clone
Version/git commit 251c5bb4bc9bb92973e738ae3c5f4ef86f103356 on next

Expected behavior

M68K base and memory-indirect displacements with the value INT32_MIN should format as -$80000000 without undefined behavior.

Actual behavior

The printer passes a signed 32-bit INT32_MIN displacement to abs(). Negating that value cannot be represented by int, and UBSan reports signed overflow in M68KInstPrinter.c.

This is also the root cause of public OSS-Fuzz issue 484248078, reported as a MemorySanitizer use-of-uninitialized-value in printAddressingMode.

Steps to reproduce the behavior

Build next with -DENABLE_ASAN=ON, then disassemble either input in M68K-040 mode:

47 f1 21 30 80 00 00 00
20 f0 ff ff 80 00 00 00 80 00 00 00

For example:

UBSAN_OPTIONS=halt_on_error=1 ./cstool m68k40 '20 f0 ff ff 80 00 00 00 80 00 00 00'

The expected output is:

move.l ([-$80000000], -$80000000), (a0)+

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions